The nss_parse_ciphers function in libraries/libldap/tls_m.c in OpenLDAP does not properly parse OpenSSL-style multi-keyword mode cipher strings, which might cause a weaker than intended cipher to be used and allow remote attackers to have unspecified impact via unknown vectors.

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - openldap: incorrect multi-keyword mode cipherstring parsing (CVE-2015-3276)

  - /usr/libexec/openldap/generate-server-cert.sh in openldap-servers sets weak permissions for the TLS     certificate, which allows local users to obtain the TLS certificate by leveraging a race condition between     the creation of the certificate, and the chmod to protect it. (CVE-2016-4984)

  - servers/slapd/back-mdb/search.c in OpenLDAP through 2.4.44 is prone to a double free vulnerability. A user     with access to search the directory can crash slapd by issuing a search including the Paged Results     control with a page size of 0. (CVE-2017-9287)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

A flaw was found in the way OpenLDAP parsed OpenSSL-style cipher strings. As a result, OpenLDAP could potentially use ciphers that were not intended to be enabled.

This update should make OpenLDAP up to date with latest NSS, notably :

  - fix olcTLSProtocolMin handling

  - fix TLS_CIPHER_SUITE parsing

  - update a list of ciphers to fit latest NSS development

  - make use of NSS global settings for `DEFAULTS'     TLS_CIPHER_SUITE keyword 

Additionaly, slapd should start correctly after network is online, now.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

A flaw was found in the way OpenLDAP parsed OpenSSL-style cipher strings. As a result, OpenLDAP could potentially use ciphers that were not intended to be enabled. (CVE-2015-3276)

The openldap packages have been upgraded to upstream version 2.4.40, which provides a number of bug fixes and one enhancement over the previous version :

  - The ORDERING matching rules have been added to the     ppolicy attribute type descriptions. * The server no     longer terminates unexpectedly when processing SRV     records. * Missing objectClass information has been     added, which enables the user to modify the front-end     configuration by standard means.

This update also fixes the following bugs :

  - Previously, OpenLDAP did not properly handle a number of     simultaneous updates. As a consequence, sending a number     of parallel update requests to the server could cause a     deadlock. With this update, a superfluous locking     mechanism causing the deadlock has been removed, thus     fixing the bug.

  - The httpd service sometimes terminated unexpectedly with     a segmentation fault on the libldap library unload. The     underlying source code has been modified to prevent a     bad memory access error that caused the bug to occur. As     a result, httpd no longer crashes in this situation.

  - After upgrading the system from Scientific Linux 6 to     Scientific Linux 7, symbolic links to certain libraries     unexpectedly pointed to locations belonging to the     openldap-devel package. If the user uninstalled     openldap- devel, the symbolic links were broken and the     'rpm -V openldap' command sometimes produced errors.
    With this update, the symbolic links no longer get     broken in the described situation. If the user     downgrades openldap to version 2.4.39-6 or earlier, the     symbolic links might break. After such downgrade, it is     recommended to verify that the symbolic links did not     break. To do this, make sure the yum-plugin-verify     package is installed and obtain the target libraries by     running the 'rpm -V openldap' or 'yum verify openldap'     command.

In addition, this update adds the following enhancement :

  - OpenLDAP clients now automatically choose the Network     Security Services (NSS) default cipher suites for     communication with the server. It is no longer necessary     to maintain the default cipher suites manually in the     OpenLDAP source code.

Updated openldap packages that fix one security issue, several bugs, and add one enhancement are now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having Moderate security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

OpenLDAP is an open source suite of Lightweight Directory Access Protocol (LDAP) applications and development tools. LDAP is a set of protocols used to access and maintain distributed directory information services over an IP network. The openldap packages contain configuration files, libraries, and documentation for OpenLDAP.

A flaw was found in the way OpenLDAP parsed OpenSSL-style cipher strings. As a result, OpenLDAP could potentially use ciphers that were not intended to be enabled. (CVE-2015-3276)

This issue was discovered by Martin Poole of the Red Hat Software Maintenance Engineering group.

The openldap packages have been upgraded to upstream version 2.4.40, which provides a number of bug fixes and one enhancement over the previous version :

* The ORDERING matching rules have been added to the ppolicy attribute type descriptions.

* The server no longer terminates unexpectedly when processing SRV records.

* Missing objectClass information has been added, which enables the user to modify the front-end configuration by standard means.

(BZ#1147982)

This update also fixes the following bugs :

* Previously, OpenLDAP did not properly handle a number of simultaneous updates. As a consequence, sending a number of parallel update requests to the server could cause a deadlock. With this update, a superfluous locking mechanism causing the deadlock has been removed, thus fixing the bug. (BZ#1125152)

* The httpd service sometimes terminated unexpectedly with a segmentation fault on the libldap library unload. The underlying source code has been modified to prevent a bad memory access error that caused the bug to occur. As a result, httpd no longer crashes in this situation. (BZ#1158005)

* After upgrading the system from Red Hat Enterprise Linux 6 to Red Hat Enterprise Linux 7, symbolic links to certain libraries unexpectedly pointed to locations belonging to the openldap-devel package. If the user uninstalled openldap-devel, the symbolic links were broken and the 'rpm -V openldap' command sometimes produced errors. With this update, the symbolic links no longer get broken in the described situation. If the user downgrades openldap to version 2.4.39-6 or earlier, the symbolic links might break. After such downgrade, it is recommended to verify that the symbolic links did not break. To do this, make sure the yum-plugin-verify package is installed and obtain the target libraries by running the 'rpm -V openldap' or 'yum verify openldap' command. (BZ#1230263)

In addition, this update adds the following enhancement :

* OpenLDAP clients now automatically choose the Network Security Services (NSS) default cipher suites for communication with the server. It is no longer necessary to maintain the default cipher suites manually in the OpenLDAP source code. (BZ#1245279)

All openldap users are advised to upgrade to these updated packages, which correct these issues and add this enhancement.

The remote Oracle Linux 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2015-2131 advisory.

    [2.4.40-8]
    - NSS does not support string ordering (#1231522)
    - implement and correct order of parsing attributes (#1231522)
    - add multi_mask and multi_strength to correctly handle sets of attributes (#1231522)
    - add new cipher suites and correct AES-GCM attributes (#1245279)
    - correct DEFAULT ciphers handling to exclude eNULL cipher suites (#1245279)

    [2.4.40-7]
    - Merge two MozNSS cipher suite definition patches into one. (#1245279)
    - Use what NSS considers default for DEFAULT cipher string. (#1245279)
    - Remove unnecesary defaults from ciphers' definitions (#1245279)

    [2.4.40-6]
    - fix: OpenLDAP shared library destructor triggers memory leaks in NSPR (#1249977)

    [2.4.40-5]
    - enhancement: support TLS 1.1 and later (#1231522,#1160467)
    - fix: openldap ciphersuite parsing code handles masks incorrectly (#1231522)
    - fix the patch in commit da1b5c (fix: OpenLDAP crash in NSS shutdown handling) (#1231228)

    [2.4.40-4]
    - fix: rpm -V complains (#1230263) -- make the previous fix do what was intended

    [2.4.40-3]
    - fix: rpm -V complains (#1230263)

    [2.4.40-2]
    - fix: missing frontend database indexing (#1226600)

    [2.4.40-1]
    - new upstream release (#1147982)
    - fix: PIE and RELRO check (#1092562)
    - fix: slaptest doesn't convert perlModuleConfig lines (#1184585)
    - fix: OpenLDAP crash in NSS shutdown handling (#1158005)
    - fix: slapd.service may fail to start if binding to NIC ip (#1198781)
    - fix: deadlock during SSL_ForceHandshake when getting connection to replica (#1125152)
    - improve check_password (#1174723, #1196243)
    - provide an unversioned symlink to check_password.so.1.1 (#1174634)
    - add findutils to requires (#1209229)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
198770	RHEL 6 : openldap (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	high
97149	Amazon Linux AMI : openldap (ALAS-2017-799)	Nessus	Amazon Linux Local Security Checks	medium
96968	Fedora 25 : openldap (2017-ceb1b8659e)	Nessus	Fedora Local Security Checks	medium
87566	Scientific Linux Security Update : openldap on SL7.x x86_64 (20151119)	Nessus	Scientific Linux Local Security Checks	medium
87132	CentOS 7 : openldap (CESA-2015:2131)	Nessus	CentOS Local Security Checks	high
87023	Oracle Linux 7 : openldap (ELSA-2015-2131)	Nessus	Oracle Linux Local Security Checks	high
86970	RHEL 7 : openldap (RHSA-2015:2131)	Nessus	Red Hat Local Security Checks	high

Detections

Analytics

CVE-2015-3276

high

Tenable Plugins

high

medium

medium

medium

high

high

high